It's 1 a.m. You've been poking at a box for two hours, you finally land a foothold, and you're thrilled. Then you close the laptop, because you have to be up in the morning.
Three days later you open the lab again. The VPN has dropped. Your terminal history is a wall of commands you can't read. Somewhere in a text file there's a password you were sure mattered, but you can't remember which service it belonged to. You also remember seeing an interesting endpoint, though you can't tell if it was on this box or the last one.
And now you find yourself spending the first hour of every session rebuilding what you already knew.
This was especially painful for me back when I was still moving my way up through HTB's first Linux boxes, certain boxes like 2Million legit had so much context that it was torture trying to pick up where I left off between sessions.
Sound familiar?
- You found a credential and have no idea where you put it.
- You can't remember which services you already tried it on.
- You saw a promising endpoint, then lost it in a pile of browser tabs and Burp history.
- You've typed the same nmap, gobuster or privilege escalation command twenty times and still have to look it up.
- You come back to a half-finished box and can't work out what you'd already ruled out.
- Someone asks how many machines you've done and you honestly can't say.
None of that is a skills problem. It's a notes problem.
Why it happens :
Hacking isn't linear. You branch, backtrack, try something, park it, and come back. Notes written as one running document capture the story of what you did, but not the state of what you know. Credentials, endpoints, open questions and dead ends get buried in paragraphs. When you come back after a few days, you have to read the whole thing and mentally reconstruct where you were.
That reconstruction is the real cost tho since it happens every session, and it's worse when you do labs in short bursts around a job, classes or life.
A few low effort free fixes :
None of these need a special tool so use Notion, Obsidian, markdown files or a spreadsheet . Pick one place and use it every time.
1. Keep one home for everything. Notes spread across three apps get checked in none of them.
2. Give every machine the same skeleton. Copy this at the start of each box:
MACHINE: OS: DIFFICULTY: PLATFORM:
STATUS: not started / in progress / rooted / stuck
IP / HOSTNAME:
SERVICES port | service + version | notes
CREDENTIALS credential | where found | works on | already tried on
ENDPOINTS path | method | parameters | status | notes
TIMELINE date | what I did | result
HANDOFF (update at the end of every session)
Where I am:
What failed:
Next step:
3. Treat credentials as data. The "already tried on" column is the one that stops you from retesting blindly or forgetting to test reuse.
4. Give every endpoint a status. "Untested" is the most useful one since it pretty much turns your found URLs into a to-do list.
5. End every session with a three-line handoff. Where you are, what failed, and your next step. It takes two minutes and removes most of the re-entry cost.
6. Keep your own command file and a box ledger. Organize commands by phase: recon, enumeration, privilege escalation. Alongside it, keep a running list of every machine with its status and date. Then you always know how many you've finished and which ones are stuck.
A note on credentials!
Obviously store only lab and CTF credentials in cloud note tools. When it comes to real engagements, follow your client agreement and datahandling rules, and consider local encrypted storage.
When the DIY version starts to hurt :
For a handful of boxes, those six fixes are enough. Once you have dozens, you're copying the skeleton by hand, searching across machines for a credential, filtering for the boxes you left stuck, and counting by eye. The part that makes notes useful is the linking: this credential belongs to this machine, this endpoint belongs to this session. Eventually it will get slow and tedious.
If you're interested in a more out-of-the-box solution however, then I do have a fix for that too, featuring :
- Machine Library: every box in one view with status, difficulty, OS and notes. How many have you done? One look.
- Session Log: one entry per sitting, linked to its machine, so you can see exactly where you left off.
- Credential Vault: each credential stored with its machine, port, service and username.
- Endpoint Tracker: each endpoint linked to its machine, with method, status, parameters found and notes.
- Active Machine page: one dashboard for the box you're on, so you don't have to hunt for context.
- Quick Reference Hub: the commands and notes you reach for most.
It's the system above with the setup and wiring already done.
Get the Cybersecurity Lab Notebook template for 15.99$ over here